You are Joaquim Sánchez-Bermúdez, CEO of Aurelia Consulting Group, a digital transformation consultancy with 850 consultants across Madrid, Mexico City and Bogotá. Four months ago, an external audit uncovered a fraud: a senior partner in the Bogotá office inflated a public-sector client's billings for 14 months. Tomorrow you present the redesign of the control system to the board. You have three options on the table and all of them are defensible.
The situation
Aurelia Consulting Group. A multi-Latin digital transformation consultancy founded in Madrid in 2003 by two former Accenture partners. Today 850 consultants across three offices — Madrid (headquarters, 410 people), Mexico City (260) and Bogotá (180) — plus a small delivery cell in Lisbon. FY2025 figures: revenue €145M, EBITDA €20.3M (14% margin), net cash €18M, no material financial debt. Five practices: Banking & Insurance, Energy & Utilities, Public Sector LatAm, Retail & Consumer and Data & AI. Classic partnership model: 42 partners (28 senior, 14 junior) who share dividends on EBITDA based on origination, delivery and utilization ratio.
You are Joaquim Sánchez-Bermúdez, 54, an industrial engineer from the Politécnica de Madrid, INSEAD MBA '99, eighteen years at McKinsey before joining Aurelia as CEO in 2019. You report to a six-member board chaired by Doña Beatriz Aurelia (the co-founder's daughter, 71, former COO of Telefónica Internacional). You hold executive authority over the partners' committee and veto commercial proposal decisions above €1M; the board approves the annual strategic plan and any move that affects the partnership agreement.
What happened in Bogotá. Four months ago, an external KPMG audit of fiscal year 2024 detected an anomaly in the account of a Colombian public-sector client — the Agencia Nacional de Infraestructura Digital. For 14 months, the partner in charge of the relationship, Andrés Maldonado (12 years at Aurelia, two on the Bogotá committee), had inflated billings by inventing deliverables: he charged hours from an offshore team that was actually working for another client, validated them with a friendly official on the client side, and pocketed the difference via a project-margin bonus scheme that the partnership distributes automatically. Total fictitious revenue detected: €2.8M. Bonus wrongfully collected by Maldonado and two implicated associates: ~€340k. Colombian prosecutors have indicted Maldonado; the Bogotá office cooperated with the external audit from day one.
What came next. The public client has cancelled the live contract (€4.2M annually). Three regional corporate clients have paused their extensions (€4.3M in signed but unbilled pipeline). Semana ran the story with a front-page headline; Cinco Días picked it up in Spain. The firm has provisioned €3.2M in legal fees and forensic audit, activated the contractual clawback on the implicated partners' bonuses (€1.8M recoverable), and the two associates have been dismissed for cause. Projected EBITDA for the current year has fallen from the €20.5M budgeted to an expectation of €6.8M — a 67% hit.
Why it happened (the unvarnished version). The executive committee, in a closed session with KPMG last week, reached three uncomfortable conclusions. First: Aurelia's code of ethics has existed as a PDF since 2011, but the last refresh was in 2018 and almost nobody in Bogotá had read it in the past 18 months. Second: the KPIs on the Bogotá P&L dashboard (revenue, project margin, utilization) were green throughout the 14 months of the fraud — Aurelia's diagnostic system did exactly what it was designed to do and detected nothing because the numbers added up. Third: the last executive committee with the three office managers physically present was in February 2024; the monthly meetings of the past twelve months were held over Teams, with a status-review agenda, no open dialogue about strategic uncertainties or risk hotspots. The Bogotá office hadn't had a face-to-face conversation with Madrid since before COVID.
P&L impact · Current FY vs budget
LineBudgetProjection Aurelia Group revenue€152M€140.5M — ANID Colombia cancellation—(4.2) — Paused pipeline (3 LatAm clients)—(4.3) Budgeted EBITDA€20.5M— — Legal and forensic provision—(3.2) — Bonus clawback (collected)—+1.8 — Gross loss from reversed fictitious revenue—(2.8) Projected EBITDA€20.5M€6.8MThe decision. Tomorrow at 10:00 you present the proposed redesign of Aurelia's control system to the board. The executive committee has agreed on the analytical framework — Simons' four levers of control (Harvard, 1995) — but not on the options. Doña Beatriz specifically asked, "I don't want a defensive compliance PowerPoint; I want a system that works." You have three possible redesigns on the table, all defensible, all with different consequences in cost, in culture, and in what they protect.